3 ms·

I've dealt with this problem my whole life and tbh it's a cost/benefit trade off. Assuming your employer isn't being flexible enough to upgrade they are simply

by ixtli 7y ago

I've dealt with this problem my whole life and tbh it's a cost/benefit trade off. Assuming your employer isn't being flexible enough to upgrade they are simply saying that the risk of exploitation of employee machines is a lower risk than the cost of upgrading. If all parties are ok with that trade off I'd say don't worry about this iterm update and also don't do anything involving PII on that computer.

jlokier 7y ago
Thanks for the advice. The principle of their risk vs their cost doesn't work in this case. Terminals vulnerabilities are a bit more serious: It means don't anything involving PII on any remote computer either, from "that computer". (If you take that seriously, that means don't access email too.) Haha, "employee machines", chuckles :-) I haven't had (or been offered) one of those in many years - except for cloud machines. Plenty of cloud machines, but I'm nearly always expected to use my own devices to access them, at my own cost. I do work with PII, for a variety of companies. About a quarter of the work I do involves direct use of PII, and another third interacts with it indirectly (such as grepping operational logs), so it has to be treated as pervasive. The non-profits I currently handle PII for do not have spare cash to buy new kit at this level, or pay for my time fiddling around. It's not so much that they don't value it. I value it after all, and I'm responsible for deciding how to handle it. So another solution will need to be found. For-profits I handle PII for (as a freelance/consultant) can of course afford machines, but it's still a problem to go cap in hand, when the expectation is that bringing an adequate terminal is my problem not theirs. Which is fine, it's just how things are done. Meanwhile, I still have physical devices that need an older MacOS for other work. And there's a problem with serious MacOS SMBFS bugs that change on each version - and have themselves caused PII issues, for real (google "delete random files once in a blue moon"). I'm not looking forward to wierdness like that all over again, and I know that later MacOS has new SMBFS bugs. So, upgrading MacOS, sadly, has known data access risks too. It's not something I should do casually, nor treat it as an unambiguous improvement from a security-of-data perspective. To a responsible person, this combination of requirements sucks. I will deal with it responsibly of course, somehow. But there's no quick and straightforward answer that meets all the requirements, and contrary to what I think some are saying, "just update" does not meet them, nor is it an unambiguous improvement.
- missblit 7y ago
  > Terminals vulnerabilities are a bit more serious: It means don't anything involving PII on any remote computer either, from "that computer". I'm not sure I understand the distinction. If someone's taken control of your computer then it doesn't matter if the terminal emulator you run on it is perfect or not. The attacker would only need to periodically screenshot your display, or dump RAM from specific processes, or something like that.
  - jlokier 7y ago
    Good point, and I agree I wasn't clear. When the GP said don't use that computer for handling PII, I thought of PII on the machine itself (e.g. local files). That might have been a misunderstanding, and my response mixed up two ideas in an unclear way: 1. The terminal with a vulnerability is likely to be the attack vector for compromising that computer in the first place, because the terminal receives output from basically everything in your fleet, and all the data you interact with, if your work is command line heavy. The more data you handle through that one machine and terminal (including PII, which can be a source of unsanitised data), the more likely the compromise is to find a way. 2. Handling PII that resides on other machines is also compromised by the terminal problem on the local machine.

by ixtli 7y ago

jlokier 7y ago

Thanks for the advice. The principle of their risk vs their cost doesn't work in this case. Terminals vulnerabilities are a bit more serious: It means don't anything involving PII on any remote computer either, from "that computer". (If you take that seriously, that means don't access email too.) Haha, "employee machines", chuckles :-) I haven't had (or been offered) one of those in many years - except for cloud machines. Plenty of cloud machines, but I'm nearly always expected to use my own devices to access them, at my own cost. I do work with PII, for a variety of companies. About a quarter of the work I do involves direct use of PII, and another third interacts with it indirectly (such as grepping operational logs), so it has to be treated as pervasive. The non-profits I currently handle PII for do not have spare cash to buy new kit at this level, or pay for my time fiddling around. It's not so much that they don't value it. I value it after all, and I'm responsible for deciding how to handle it. So another solution will need to be found. For-profits I handle PII for (as a freelance/consultant) can of course afford machines, but it's still a problem to go cap in hand, when the expectation is that bringing an adequate terminal is my problem not theirs. Which is fine, it's just how things are done. Meanwhile, I still have physical devices that need an older MacOS for other work. And there's a problem with serious MacOS SMBFS bugs that change on each version - and have themselves caused PII issues, for real (google "delete random files once in a blue moon"). I'm not looking forward to wierdness like that all over again, and I know that later MacOS has new SMBFS bugs. So, upgrading MacOS, sadly, has known data access risks too. It's not something I should do casually, nor treat it as an unambiguous improvement from a security-of-data perspective. To a responsible person, this combination of requirements sucks. I will deal with it responsibly of course, somehow. But there's no quick and straightforward answer that meets all the requirements, and contrary to what I think some are saying, "just update" does not meet them, nor is it an unambiguous improvement.

missblit 7y ago
> Terminals vulnerabilities are a bit more serious: It means don't anything involving PII on any remote computer either, from "that computer". I'm not sure I understand the distinction. If someone's taken control of your computer then it doesn't matter if the terminal emulator you run on it is perfect or not. The attacker would only need to periodically screenshot your display, or dump RAM from specific processes, or something like that.
- jlokier 7y ago
  Good point, and I agree I wasn't clear. When the GP said don't use that computer for handling PII, I thought of PII on the machine itself (e.g. local files). That might have been a misunderstanding, and my response mixed up two ideas in an unclear way: 1. The terminal with a vulnerability is likely to be the attack vector for compromising that computer in the first place, because the terminal receives output from basically everything in your fleet, and all the data you interact with, if your work is command line heavy. The more data you handle through that one machine and terminal (including PII, which can be a source of unsanitised data), the more likely the compromise is to find a way. 2. Handling PII that resides on other machines is also compromised by the terminal problem on the local machine.